agenttesla | d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe
Size 594KB
Sample240608-b4lqvafc8w
SHA256 d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59
MD5 356dc42e4c17290c0f54e4829fe4cf03
SHA1 84f6739af039402382bffaa3abbd8a90bce76ed5
SHA512 d6af65e4a9b0308c4c8ebf0478fb05eec1951e8a2a17b58f4909bece63fed17ce0bf7d029fae245fcd0886809c007b4e032e668e1c33642942ff3edfbcde6c5c
SSDEEP 12288:kTj4pkrsbUYPXy+i1P2ZAkPdFd1Qfr7gmhesHTVg2ojk1k2Y61LW1MAV6rMl:kTj4pkQbUb2jFdwR/GxjkYL1xl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
ftp
Host
ftp://ftp.normagroup.com.tr
Port
21
Username
[email protected]
Password
Qb.X[.j.Yfm[

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org
13	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
624	msbuild.exe
624	msbuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	msbuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	msbuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 624	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	83
PID 2912 wrote to memory of 4880	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	84
PID 2912 wrote to memory of 4880	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	84
PID 2912 wrote to memory of 4880	2912	d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe	84

C:\Users\Admin\AppData\Local\Temp\d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe
"C:\Users\Admin\AppData\Local\Temp\d084ed177dc516629750506c98eef8b8d8eb31e7f51d7006b10974d30aabed59.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-10-0x0000000006580000-0x00000000065D0000-memory.dmp

Download

memory/624-14-0x0000000075450000-0x0000000075C00000-memory.dmp

Download

memory/624-13-0x000000007545E000-0x000000007545F000-memory.dmp

Download

memory/624-12-0x0000000006800000-0x000000000680A000-memory.dmp

Download

memory/624-4-0x0000000000400000-0x0000000000440000-memory.dmp

Download

memory/624-5-0x000000007545E000-0x000000007545F000-memory.dmp

Download

memory/624-6-0x0000000005790000-0x0000000005D34000-memory.dmp

Download

memory/624-7-0x0000000005140000-0x00000000051A6000-memory.dmp

Download

memory/624-8-0x0000000075450000-0x0000000075C00000-memory.dmp

Download

memory/624-11-0x0000000006670000-0x0000000006702000-memory.dmp

Download

memory/2912-3-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

Download

memory/2912-9-0x00007FFB9CE20000-0x00007FFB9D8E1000-memory.dmp

Download

memory/2912-0-0x00007FFB9CE23000-0x00007FFB9CE25000-memory.dmp

Download

memory/2912-2-0x0000012835FB0000-0x0000012836044000-memory.dmp

Download

memory/2912-1-0x000001281B8D0000-0x000001281B8DA000-memory.dmp

Download